# Hash generator for Next.js & Supabase. All in your browser.

Generate checksums and HMACs, or hash and verify disposable bcrypt passwords with an explicit cost. UTF-8 inputs stay local — free, no sign-up.

Page: https://saascode.ai/tools/hash-generator

## How to use

1. Choose a checksum, HMAC, bcrypt hash or bcrypt verification. Use disposable test values.
2. Choose the algorithm or bcrypt cost. HMAC takes a test key; verification takes an existing bcrypt hash.
3. Generate or verify locally, then copy or download. Clear values when finished and keep production credentials off public tools.

## Scope

Exact UTF-8 text, including whitespace. MD5/SHA-1 are unsuitable for passwords. bcrypt costs 4–12 and 72-byte maximum. No encryption, password recovery or auth provisioning.

## References

- [Web Crypto digest algorithms](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest)
- [bcryptjs limits and API](https://github.com/dcodeIO/bcrypt.js)
- [OWASP password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)
- [pgcrypto password functions](https://www.postgresql.org/docs/current/pgcrypto.html)

## Build your SaaS

[Build from SaaSCode Base](https://saascode.ai/free)

## Related tools

- [Base64 encode / decode](https://saascode.ai/tools/base64)
- [Markdown editor & table generator](https://saascode.ai/tools/markdown-editor)
- [Unix timestamp converter](https://saascode.ai/tools/unix-timestamp-converter)
- [All free tools](https://saascode.ai/tools)

## FAQ

### Is this free, and does my input leave the browser?

Free, no sign-up. Computation, copy and downloads stay in your browser. There is no upload or processing endpoint. Usage analytics include only a fixed tool name and action, never your input or result.

### Can MD5 or SHA-1 store passwords?

No. MD5 and SHA-1 are unsuitable for passwords and collision-resistant security uses. SHA-256 and SHA-512 alone are also fast hashes, not password-storage schemes. Use a reviewed password hashing approach in your application.

### Can I decrypt an MD5, SHA or bcrypt hash?

No. Hashing is one-way, not encryption. bcrypt verification hashes a candidate with the stored salt and cost, then compares. A match says nothing about password strength.

### Which algorithms use Web Crypto?

SHA-1, SHA-256, SHA-512 and HMAC with those SHA algorithms use browser Web Crypto. MD5 uses a small RFC 1321 implementation because Web Crypto does not support it. bcrypt uses bcryptjs locally.

### Why reject long bcrypt passwords and high costs?

bcrypt accepts at most 72 UTF-8 bytes; longer inputs are rejected instead of silently truncated. Browser hashing and verification support costs 4–12. Low costs are test settings, not production recommendations. Higher costs can take several seconds.

### How does this relate to a Supabase seed?

Use a bcrypt result only where your reviewed seed expects bcrypt. pgcrypto's password form is extensions.crypt(test_password, extensions.gen_salt('bf', cost)); verify the extension schema and auth workflow. Do not publish real passwords or treat hashing as user provisioning.